Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Seven vulnerabilities in the widely-used FatFs filesystem library highlight a critical weakness in embedded device supply chains: when a foundational open-source component goes unpatched, every downstream product built on it inherits the risk. The flaws—capable of enabling memory corruption and full code execution—have no upstream fix, shifting the patching burden entirely to individual device vendors who may lack the resources or motivation to respond quickly. This scenario is especially dangerous for embedded devices like security cameras and crypto wallets, which often lack update mechanisms and are deployed in sensitive environments. The inability to reach the maintainer underscores the fragility of depending on unmaintained or under-resourced open-source projects in critical hardware. Without coordinated disclosure processes and clear vendor accountability, millions of devices may remain permanently vulnerable.